registry / @grantjs/server / 1.24.0
@grantjs/server@1.24.0
Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js
AI Security Review
scanned 16h ago · by lpm-firewall-aiThe manifest and inspected entry-point bundles match the stated server authorization SDK purpose. The fingerprint hint did not correspond to observed malicious behavior: credentials are used in the authorization request to the configured API, and there are no install lifecycle scripts.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Applications invoke the client or register the middleware/guard to authorize a request.
Impact
The observed network request supports the package's stated authorization function; no unrelated collection or automatic install behavior was identified.
Mechanism
The client sends the requested permission context and request credentials to the configured API URL for authorization.
AI rationale
The manifest and inspected entry-point bundles match the stated server authorization SDK purpose. The fingerprint hint did not correspond to observed malicious behavior: credentials are used in the authorization request to the configured API, and there are no install lifecycle scripts.
Network endpoints2
api.grant.com (documented example; runtime base URL is caller-configured)/api/auth/is-authorized
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a server authorization SDK for Express, Fastify, NestJS and Next.js.
- The declared npm scripts are build, type-check, lint and test tasks; there are no install lifecycle scripts.
- The client posts the requested resource and action to /api/auth/is-authorized, using the configured API URL and the request's bearer token or cookie.
Evidence against
Behavioral surface
EnvironmentVars
Source & flagged code
6 flaggeddist/nest.cjsView file
•matchType = malicious_source_fingerprint_signature
signature = 80687cbc7fc3ee80
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @grantjs/server@1.22.0
matchedPath = dist/nest.cjs
matchedIdentity = npm:QGdyYW50anMvc2VydmVy:1.22.0
similarity = 1.000
shingleOverlap = 14
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/nest.cjsView on unpkgpackage.jsonView file
1{
"name": "@grantjs/server",
"version": "1.24.0",
"description": "Server SDK for Grant authorization - Middleware and guards for Express, Fastify, NestJS, and Next.js",
"type": "modu
Medium
Stripped Provenance Metadata
The manifest describes a server authorization SDK for Express, Fastify, NestJS and Next.js.
package.jsonView on unpkg · L1100"scripts": {
"build": "vite build",
"build:watch": "vite build --watch",
"type-check": "tsc --noEmit",
"lint": "eslint src --ext .ts",
"lint:fix": "eslint src --ext .ts --fix",
"test": "vitest",
"test:run": "vitest run",
"test:coverage": "vitest run --coverage"
}
Findings
1 High5 Medium2 Low
HighKnown Malware Source Fingerprint Signaturedist/nest.cjs
MediumEnvironment Vars
MediumStripped Provenance Metadatapackage.json
MediumStripped Provenance Metadatadist/grant-client-DEaSxech.cjs
MediumStripped Provenance Metadatadist/grant-client-DEaSxech.cjs
MediumStripped Provenance Metadatadist/grant-client-DEaSxech.cjs
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @grantjs/server@1.24.0.
See all versions of @grantjs/server for other recorded verdicts.
- Review the evidence and your use of @grantjs/server@1.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.